Server Hardening

Read more about the article Nginx Rate Limiting and Bot Mitigation Without Blocking Real Users

Nginx Rate Limiting and Bot Mitigation Without Blocking Real Users

A limit_req block that parses cleanly can still be doing absolutely nothing, or throttling every visitor behind one CDN edge. This guide covers Nginx rate limiting and bot mitigation as they actually behave in production: getting the key right behind a proxy, what burst and nodelay do to your traffic shape, sizing zones correctly, rolling out in dry run mode, and layering bot handling from robots.txt through user agent maps to firewall escalation.

Continue ReadingNginx Rate Limiting and Bot Mitigation Without Blocking Real Users
Read more about the article Bootstrap a VPS With Ansible in One Run Without Locking Yourself Out

Bootstrap a VPS With Ansible in One Run Without Locking Yourself Out

A single Ansible run can take a blank VPS to a hardened, reproducible server. The hard part is not the tasks, it is the order. Here is the ordering that keeps you logged in, the failures that pass green and bite two weeks later, and how to make the second run as safe as the first.

Continue ReadingBootstrap a VPS With Ansible in One Run Without Locking Yourself Out
Read more about the article You Probably Didn’t Harden That Server: A VPS Setup and Hardening Checklist That Verifies Itself

You Probably Didn’t Harden That Server: A VPS Setup and Hardening Checklist That Verifies Itself

You set PasswordAuthentication no, restarted SSH, and moved on. Months later the logs show successful password logins, because a vendor drop-in file sorted earlier and won. A VPS setup and hardening checklist where every step comes with the command that proves it worked.

Continue ReadingYou Probably Didn’t Harden That Server: A VPS Setup and Hardening Checklist That Verifies Itself